5.1 Old-Format, Historical Threat Levels.The researcher noted that though it took some time, eventually he was able to get in contact with Case IH, and the vendor fixed the reported issues.

'We could just browse the Java Melody server for your sessions and it was all publicly accessible, which is ridiculous,' the researcher said. The researcher was able to learn that Case IH was using a publicly accessible Java Melody server, which provided visibility and control into equipment actions. Case IH was also found to be lacking by Sick Codes. John Deere wasn't the only farming equipment vendor where the researcher found issues. The researcher then also got the U.S government's Cybersecurity and Infrastructure Security Agency (CISA) involved, which helped to get the issues remediated. The researcher noted that all the vulnerability information was disclosed to John Deere, which wasn't immediately responsive. 'We could literally do whatever the heck we wanted with anything we wanted on the John Deere Operations Center, period,' he said. Sick Codes detailed how he was able get access to a remote system that essentially gave him control of some connected farming devices that the John Deere Operations Center had access to. 'Obviously XSS is a really basic vulnerability, but what it does show you is that they're not taking into consideration basic vulnerabilities,' the researcher said.ДЄs it turns out, the XSS was only the least of the problems. There was also a Cross Site Scripting (XSS) vulnerability that enabled the researcher to get even more information. With that vulnerability, he was easily able to identify user names of equipment owners. There were multiple vulnerabilities that the researcher was able to discover, including what he referred to as a basic username enumeration issue. In the case of farming equipment vendor John Deere, Sick Codes noted that information and control can be handled remotely via the John Deere Operations Center, which he and his colleagues were able to hack into. Farming equipment also now increasingly makes use of the LoRa protocol, as well as NTRIP, which helps to provide accurate positioning. The researcher noted that nearly every single farm today is connected with a variety of different technologies, including cellular with 4G and 5G, as well as Wi-Fi and GPS. The Vulnerabilities of the Connected Farm 'What we consider downtime in a website for five minutes, might be the difference between a tractor driving auto track going offline, while the tractor keeps driving, hits a tree, or injures someone,' Sick Codes said. Another large risk would come from the fact that an attacker could gain control of a farming device like a tractor and send it to the wrong location or even drive it off the farm onto a highway.

With a denial of service attack, the ability for a farmer to plant seeds at a critical time can be impacted, preventing the farmer from growing crops. For example, a hacker could direct chemical treatments to be over-sprayed, turning fertile land into infertile land that can't be used for generations. The researcher detailed a litany of disastrous potential things that can happen if an attacker were able to gain access to the connected farms. The researcher explained that modern farming equipment is increasingly being automated, with the equipment being controlled from a centralized console that could have access to many different farms. On August 8, at the DEF CON 29 conference, an Australian researcher known only as ' Sick Codes' detailed what he referred to as a 'tractor load of vulnerabilities' that, if exploited by an attacker, would have dire consequences for the global food supply chain.

But what if that farming equipment were hacked? Autonomous farming equipment that can be controlled remotely now helps to feed humanity.

Defcon warning system